Skip to content
OpenAdvisories

Vendor

opennextjs

2 known vulnerabilities.

Products

@opennextjs/cloudflare 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-100409

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistentl…

    opennextjs @opennextjs/cloudflare @opennextjs/cloudflare npm
  • High 7.7
    CVE-2026-3125

    SSRF vulnerability in opennextjs-cloudflare via /cdn-cgi/ path normalization bypass

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler in…

    opennextjs @opennextjs/cloudflare